Huntress: The evolving tradecraft of ClickFix

The report

Read the full analysis: Huntress: The evolving tradecraft of ClickFix (huntress.com).

What the report says

Huntress researchers describe how ClickFix has grown beyond simple script or loader delivery into attack chains that establish persistence, support lateral movement and enable reconnaissance and credential theft. The report says fake verifications are becoming more elaborate and delivery methods more varied, including malvertising, typosquatting, SEO poisoning and compromised websites. The visible text is truncated partway through the section on PowerShell-based fake verifications.

• The report says ClickFix is now used as an initial access step leading to lateral movement, and has been seen with browser-cache-seeded delivery chains, remote access trojans (RAT) that use node.js, and executables reconstructed from data hidden in PNG files.
• Some incidents show the ClickFix page displaying fake verification progress to convince targets the steps are legitimate, while silently downloading and executing payloads.
• In a typosquatting case, a user searched Bing for “Westlaw” and clicked a paid ad. It redirected to a typosquatted domain vvestalw.ghost[.]io, then after a couple of redirects to a fake site at westlaw-signon[.]com that presented a standard ClickFix workflow.
• Another campaign used sponsored search ads and SEO poisoning aimed at users searching for LinkedIn or real estate, leading to a spoofed LinkedIn site with a fake Cloudflare “Verify that you are human” turnstile that starts the ClickFix process.
• A dental practice website that was temporarily compromised with ClickFix, found by Huntress researcher John Hammond, used a fake Manage Consent pop-up as part of the lure. Clicking Accept, or anywhere, brought up the fake Cloudflare turnstile.
• After the fake turnstile is checked, ClickFix instructions are shown and a malicious PowerShell command is placed in the clipboard. The report also lists recent Huntress blogs on a ClickFix campaign mimicking Amazon and calling the finger utility, Custom GPTs funnelling targets to ClickFix lures, a ClickFix-style prompt to “decrypt” a Google Doc, and a macOS campaign that uses a ClickFix lure to decide which payload to deliver.

Named in the report: ClickFix, PowerShell, node.js, finger, Westlaw, Thomson Reuters, Cloudflare, Bing.

This digest was written from the report text itself by a language model and checked by script: every number and CVE id in it appears in the report. The report is the source; read it for the full detail.

Indicators

The report is tracked for context; no indicator from it met the bar for blocking (for example, it only names shared hosting).

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#40). This page is generated from that record and the report itself; the indicators are never rewritten.